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DETAILED ACTION 

This application has been examined. Claims 1 -,3,5-45 are pending. Claim 4 has 
been cancelled. 

Priority 

The effective date of the claims described in this application is January 1 1 , 2002. 

Claim Rejections - 35 USC § 101 

35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 



Claims 1-23, 35,36-38 rejected under 35 U.S.C. 101 because the claimed 
invention is directed to non-statutory subject matter. 

Claims 1-22 are describing an API that is described as 'instructions' and is not 
embodied in manner that is considered statutory. 

Claims 23, 35,36-38 recite limitations citing 'tangible computer readable media' 
which the Applicant Specifications (page 14) define as a carrier wave or modulate data 
signals embodied in a carrier wave. The Examiner notes that said carrier wave or data 
signals embodied in a carrier wave are non-statutory subject matter. The Examiner 
notes that absent some physical context, a signal per se is an abstract idea in much the 
same way that a mathematical algorithm without context is an abstract idea. 
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The word 'tangible' is not sufficient to exclude non-storage computer media, and 
thus is not considered sufficiently embodying said Claims in statutory subject matter. 



Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only if the international application designated the United States and v\/as published under Article 21(2) 
of such treaty in the English language. 

Claims 1-4. 24, 35, 36, 39 are rejected under 35 U.S.C. 102(e) as being 
anticipated by Carter et al. (US Patent 67421 14), hereinafter referred to as Carter. 



Carter disclosed Claim 1 - An application programming interface (API) for 
communication between an administration server and an authentication server 
connected via a data communication network, said administration server providing a 
service associated with a namespace to one or more users on the data communication 
network, said authentication server having a database associated therewith storing 
authentication information for authenticating the users of the namespace service, said 
administration server being responsive to an administrator for issuing at least one 
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request to said authentication server, said request specifying at least one action to be 
performed in relation to the namespace, said API comprising instructions for: receiving, 
by the authentication server, the request from the administration server; (Column 3 
Lines 30-35) verifying, by the authentication server, authority of the administration 
server to issue the request received by the authentication server; (Column 3 Lines 40- 
45) and performing, by the authentication server, the action specified by the received, 
verified request. (Column 4 Lines 15-20) 

Carter disclosed Claim 2 - The API of claim 1 , wherein the database associated 
with the authentication server stores authorization information relating to the 
administration server and wherein verifying the authority of the administration server to 
issue the request comprises identifying the administration server and locating 
corresponding authorization information for the administration server in the database 
associated with the authentication server. (Column 8 Lines 35-40) 



Carter disclosed Claim 3 - The API of claim 2, wherein identifying the 
administration server comprises examining an encrypted ticket accompanying the 
request, said ticket identifying the administrator. (Column 8 Lines 20-25) 
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Carter disclosed Claim 4 - The API of claim 2, wherein identifying the 
administration server comprises examining an encrypted ticket accompanying the 
request, said ticket identifying the administrator. (Column 8 Lines 20-25) 

Carter disclosed Claim 24 - A method for delegating at least one administrative 
task from a first system to a second system, said first and second systems connected 
via a data communication network, said second system providing a service associated 
with a namespace to one or more users on the data communication network, said 
method comprising: maintaining a database of one or more namespaces including the 
namespace associated with the second system, said database being maintained by the 
first system; (Column 8 Lines 20-25) receiving a call from the second system by the first 
system, said call providing a request that at least one routine be performed to 
implement a desired administrative task for managing the database; (Column 3 Lines 
30-35) and executing the routine, by the first system, in response to the call received 
from the second system to implement the administrative task. (Column 4 Lines 15-20) 

Claims 35, 36, and 39 are rejected on the same basis as Claims 1-4, 24. 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1-21, 23-25, 27-41, and 43-45 are rejected under 35 U.S.C. 103(a) as 

being unpatentable over Chan (US Publication 2002/0165960) in view of Carter et al. 

(US Patent 67421 14), hereinafter referred to as Carter. 

With respect to Claim 1 Chan disclosed an application programming interface 
(API) for communication between an administration server and an authentication server 
connected via a data communication network, said administration server providing a 
service to one or more users on the data communication network, said authentication 
server having a database associated therewith storing authentication information for 
authenticating the users service, said administration server being responsive to an 
administrator for issuing at least one request to said authentication server, said request 
specifying at least one action to be performed, said API comprising instructions for: 
receiving, by the authentication server, the request from the administration server; 
(Chan - Figure 38, Paragraph 223) 

However Chan did not disclose said administration server providing a service 
associated with a namespace. Chan did not disclose verifying, by the authentication 
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server, authority of the administration server to issue the request received by the 
authentication server; and performing, by the authentication server, the action specified 
by the received, verified request. 

Carter disclosed deputization of rights across boundaries imposed by 
namespaces and particular network protocols. A deputy may also delegate rights to 
additional deputies. Deputization is accomplished using certificates, domain/realm- 
specific credentials, public and private keys, process creation, and other tools and 
techniques. 

Chan and Carter are analogous art because they present concepts and practices 
regarding managing access to a related group of resources, such as resources in a 
domain or namespace. (Chan - Paragraph 23, Carter - Column 9 Lines 45-50) At the 
time of the invention it would have been obvious to a person of ordinary skill in the art to 
combine the teachings of Carter regarding deputizing and delegating rights from one 
namespace into another into the system of Chan. The combination of Chan and Carter 
would have disclosed an administration server (Chan - Paragraph 101) providing a 
service associated with a namespace (Carter - Column 5 Lines 5-10, Column 6 Lines 5- 
10). The combination of Chan and Carter would have disclosed verifying, by the 
authentication server, authority of the administration server to issue the request 
received by the authentication server; (Carter - Column 3 Lines 40-45) and performing, 
by the authentication server, the action specified by the received, verified request. 
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(Carter - Column 4 Lines 15-20) The motivation for said combination would have been, 
as Carter suggests (Carter - Lines 5 Lines 1-5) , so that entities responsible for 
particular actions can be more readily identified. 

The combination of Chan and Carter disclosed Claim 2 - The API of claim 1 , 
wherein the database associated with the authentication server stores authorization 
information relating to the administration server and wherein verifying the authority of 
the administration server to issue the request comprises identifying the administration 
server and locating corresponding authorization information for the administration 
server in the database associated with the authentication server. (Carter - Column 8 
Lines 35-40) 

The combination of Chan and Carter disclosed Claim 3 - The API of claim 2, 
wherein identifying the administration server comprises examining an encrypted ticket 
accompanying the request, said ticket identifying the administrator. (Carter - Column 8 
Lines 20-25) 

The combination of Chan and Carter disclosed Claim 4 - The API of claim 2, 
wherein identifying the administration server comprises examining an encrypted ticket 
accompanying the request, said ticket identifying the administrator. (Carter - Column 8 
Lines 20-25) 
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The combination of Chan and Carter disclosed Claim 5 - The API of claim 1 , 
wherein performing the specified action comprises reserving the namespace to prevent 
an unauthorized user from obtaining an account in the namespace. (Chan - Paragraph 
129) 

The combination of Chan and Carter disclosed Claim 6 - The API of claim 5, 
wherein reserving the namespace comprises creating an administrator account 
associated with the administration server to manage the namespace. (Chan - 
Paragraph 103-104) 

The combination of Chan and Carter disclosed Claim 7 - The API of claim 1 , 
wherein perfomiing the specified action comprises releasing the namespace to allow 
any user to obtain an account in the namespace. (Chan - Paragraph 129) 

The combination of Chan and Carter disclosed Claim 8 - The API of claim 1 , 
wherein performing the specified action comprises maintaining and editing a 
namespace administrator list. (Chan - Paragraph 103-104) 

The combination of Chan and Carter disclosed Claim 9 - The API of claim 8, 
wherein editing a namespace administrator list comprises adding at least one 
administrator to the namespace administrator list. (Chan - Paragraph 103-104) 

The combination of Chan and Carter disclosed Claim 10 - The API of claim 8, 
wherein editing a namespace administrator list comprises deleting at least one 
administrator firom the namespace administrator list. (Chan - Paragraph 103-104) 



Application/Control Number: 10/044,565 Page 10 

Art Unit: 2144 

The combination of Chan and Carter disclosed Claim 1 1 - The API of claim 1 , 
wherein performing the specified action comprises editing one or more user accounts in 
the namespace. (Chan - Paragraph 129) 

The combination of Chan and Carter disclosed Claim 12 - The API of claim 1 1 , 
wherein editing one or more user accounts in the namespace comprises creating at 
least one user account in the namespace. (Chan - Paragraph 260-261 ) 

The combination of Chan and Carter disclosed Claim 1 3 - The API of claim 1 1 , 
wherein editing one or more user accounts in the namespace comprises resetting a 
namespace password associated with at least one of the user accounts. (Chan - 
Paragraph 260-261) 

The combination of Chan and Carter disclosed Claim 1 4 - The API of claim 1 1 , 
wherein editing one or more user accounts in the namespace comprises removing at 
least one of the user accounts from the namespace. (Chan - Paragraph 260-261) 

The combination of Chan and Carter disclosed Claim 1 5 - The API of claim 1 1 , 
wherein editing one or more user accounts in the namespace comprises editing a profile 
associated with at least one of the user accounts. (Chan - Paragraph 260-261 ) 

The combination of Chan and Carter disclosed Claim 16 - The API of claim 1 1 , 
wherein editing one or more user accounts in the namespace comprises changing a 
sign-in name associated with at least one of the user accounts. (Chan - Paragraph 260- 
261) 

The combination of Chan and Carter disclosed Claim 17 - The API of claim 1 , 
wherein performing the specified action comprises: listing user accounts associated with 
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the namespace; (Chan - Paragraph 134) and evicting one or more of the user 
accounts from the namespace. (Chan - Paragraph 260-261 ) 

The combination of Chan and Carter disclosed Claim 18 - The API of claim 17, 
wherein performing the specified action further comprises permitting the respective user 
to contest an evicted account. (Chan - Paragraph 256) 

The combination of Chan and Carter disclosed Claim 19 - The API of claim 1 , 
wherein performing the specified action comprises auditing actions within user accounts 
associated with the namespace. (Chan - Paragraph 134) 

The combination of Chan and Carter disclosed Claim 20 - The API of claim 1 , 
further comprising returning a success response from the authentication server to the 
administration server if the request was received, the administration server was verified, 
and the specified action was performed successfully.(Chan - Paragraph 142) 

The combination of Chan and Carter disclosed Claim 21 - The API of claim 1 , 
wherein performing the specified action comprises returning an error response from the 
authentication server to the administration server if the request was received, the 
administration server was not verified, or the specified action was performed 
unsuccessfully. (Chan - Paragraph 142) 

The combination of Chan and Carter disclosed Claim 23 - The API of claim 1 , 
wherein the instructions are computer-executable instructions stored on one or more 
computer readable media. (Chan - Paragraph 101 ) 
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The combination of Chan and Carter disclosed Claim 24 - A method for 
delegating at least one administrative task from a first system to a second system, said 
first and second systems connected via a data communication network, said second 
system providing a service associated with a namespace to one or more users on the 
data communication network, said method comprising: maintaining a database of one or 
more namespaces including the namespace associated with the second system, said 
database being maintained by the first system; (Carter - Column 8 Lines 20-25) 
receiving a call from the second system by the first system, said call providing a request 
that at least one routine be performed to implement a desired administrative task for 
managing the database; (Carter - Column 3 Lines 30-35) and executing the routine, by 
the first system, in response to the call received from the second system to implement 
the administrative task. (Carter - Column 4 Lines 15-20) 

The combination of Chan and Carter disclosed Claim 25 - The method of claim 
24 wherein the routine comprises an application programming interface (API) for 
performing the administrative task. (Chan - Paragraph 269-270) 

Claim 27-41, and 43^5 are rejected on the same basis as Claims 1-25, as 
disclosed by the combination of Chan and Carter. 
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Claims 22,26, and 42 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Chan (US Publication 2002/0165960) in view of Carter et al. (US 
Patent 67421 14), hereinafter referred to as Carter, further in view of Convent et al. (US 
Publication 2002/0016814) hereinafter referred to as Convent. 

While the combination of Chan and Carter substantially disclosed the invention, 
the said combination did not disclose using an API based on a simple object access 
protocol (SOAP). 

Convent disclosed a method and system for providing an API using the Simple 
Object Access Protocol. (Paragraph 25) 

Chan, Carter and Convent are analogous art because they teach exchanging 
messages between elements in a distributed computing environment. At the time of the 
invention it would have been obvious to combine the teachings of Convent into the 
combined systems of Chan and Carter, in order to allow the API of Chan and Carter to 
communicated using SOAP. The combination of Chan.Carter and Convent would have 
disclosed Claim 22, 26, 42 wherein the API is based on a simple object access protocol 
(SOAP). The motivation for the said combination would have been, as Convent 
suggests (Convent - Paragraph 8), to enable the API to invoke legacy database stored 
procedures. 
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Response to Arguments 

Applicant's arguments filed 12/08/2005 have been fully considered but they are 
not persuasive. 

The Applicant presents the following argument(s) [in italics]: 

'...the present invention performs a task or action that manages an authentication 
database.. ..this limitation is completely absent from the Carter et al. invention. . . .claim 
1 . . recites. . .said request specifying at least one action for managing the database to 
be performed to the namespace. . ..' 

The Examiner respectfully disagrees with the Applicant. Carter disclosed 
maintaining authentication information in the DDP or a security database. (Carter - 
Column 8 Lines 55-57) Thus, each principal that creates a deputy effectively requests a 
task that requires action on the database. The task of creating a deputy would comprise 
inserting or updating records in a database and would be considered managing the 
authentication database. 

Conclusion 

Examiner's Note: Examiner has cited particular columns and line numbers in 
the references applied to the claims above for the convenience of the applicant. 
Although the specified citations are representative of the teachings of the art and are 
applied to specific limitations within the individual claim, other passages and figures 
may apply as well. It is respectfully requested from the applicant in preparing 
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responses, to fully consider the references in entirety as potentially teaching all or part 
of the claimed invention, as well as the context of the passage as taught by the prior art 
or disclosed by the Examiner. 

In the case of amending the claimed invention, Applicant is respectfully 
requested to indicate the portion(s) of the specification v\rhich dictate(s) the stmcture 
relied on for proper interpretation and also to verify and ascertain the metes and bounds 
of the claimed invention. 

The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

US 2003011 5201 A1 Krishnamoorthy, Satheesh Kumar - a method of providing 
entitlement services information to users comprising receiving a request for entitlement 
services information for a particular user; and in response to receiving the request, 
accessing a common entitlement services information repository 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Greg Bengzon whose telephone number is (571) 272- 
3944. The examiner can normally be reached on Mon. thru Fri. 8 AM - 4:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David Wiley can be reached on (571 )272-3923. The fax phone number for 
the organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from tlie 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-21 7-91 97 (toll-free). 
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